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IN THE CLAIMS 

1-16. (canceled). 

17. (currently amended) An unauthorized- 
operation- judgment system for determining whether an 
operation received by a computer is an unauthorized 
operation, comprising: 

an operation-receiver that receives instruction 
data for executing causing said computer to execute said 
operation; 

a first profile-creator that creates a first 
profile from said instruction data , wherein said first 
profile is at least partially representative of said 
operation related to the operation for which instruction 
data was received by said computer ; 

a first prof ile-storer that stores said first 
profile that was created by said first profile-creator; 

a second profile-creator that identifies a user 
that executed said operation by said instruction data, and 
that creates a second profile related to the operation 
executed by said user; 
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a second prof ile-storer that stores, according to 
a user account , said second profiles created by said second 
profile-creator; and 

a score-calculator that compares said instruction 
data with at least one profile that is stored in said first 
prof ile-storer or in said second prof ile-storer , and that 
calculates a score for determining whether said operation 
is an unauthorized operation, wherein said score^calculator 
compares said instruction data with said first profile when 
said instruction data is received while said computer is 
not logged into a said user account, and wherein the score^ 
calculator compares said instruction data with at least 
said second profile corresponding to said user account when 
said instruction data is received while said computer is 
logged into said user account. 

18. (currently amended) The unauthorized- 
operation- judgment system of claim 17 further comprising: 

a first log-data-storer for storing log data ef- 
related to said operation received by said computer; and 

a second log-data-storer for storing log data 
according to a user of said computer; 

wherein 
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said first profile-creator references said first 
log-data- storer when creating said first profile; and 

said second profile-creator references said 
second log-data-storer when creating said second profile. 



19. (currently amended) The unauthorized- 
operation- judgment system of claim 17 further comprising: 

a login-detector for executing a process for 
detecting whether a certain user is logged into said 
computer; 

wherein when said login-detector detects that a 
certain user is logged in, said second profile-creator 
creates a said second profile related to said user. 

20. (previously presented) The unauthorized- 
operation- judgment system of claim 19, wherein said login- 
detector executes detection processing at specified 
intervals while said computer is in operation. 



21. (previously presented) The unauthorized- 
operation- judgment system of claim 19, wherein when said 
login-detector does not detect that a certain user is 
logged in even though detection processing is executed, 
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said first profile-creator creates a first profile related 
to said computer. 

22. (previously presented) The unauthorized- 
operation- judgment system of claim 21, wherein said login- 
detector executes detection processing at specified 
intervals while said computer is in operation. 

23 . (previously presented) The unauthorized- 
operation- judgment system of claim 17 further comprising: 

a third profile-creator for creating a third 
profile related to an operation executed by a user that is 
identified as a first-time user, when the user executing 
said operation by said instruction data is identified as a 
first -time user operating said computer for the first time; 
and 

a third prof ile-storer for storing third profiles 
that are created by said third profile-creator; 

wherein said score-calculator uses at least one 
profile that is stored in said third prof ile- storer instead 
of said second prof ile-storer to determine whether said 
operation is an unauthorized operation. 
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24 . (previously presented) The unauthorized- 
operation- judgment system of claim 23 further comprising: 

an operation-record-storer for storing, according 
to user, totals related to at least one of the following: 
number of logins to said computer, operation time that said 
computer has been operated, or number of days said computer 
has been operated; and 

a first-time-user- judgment mechanism for 
referencing said operation-record-storer, and determining 
that a user executing said operation is a first -time user 
using said computer for the first time when said totals do 
not satisfy preset reference values; and 

wherein 

said third profile-creator creates a third 
profile for an operation executed by a user that is 
determined to be a first-time user by said first-time-user- 
judgment mechanism; and 

said score-calculator uses at least one profile 
stored in said third prof ile-storer when said first-time- 
user- judgment mechanism determines that a user is a first- 
time user to determine whether said operation is an 
unauthorized operation. 
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25. (previously presented) The unauthorized- 
operation- judgment system of claim 17, wherein 

said score-calculator calculates a score by 
calculating a deviation between said instruction data and 
data that is stored in said profiles. 

26. (previously presented) The unauthorized- 
operation- judgment system of claim 17, further comprising: 

an operation- stopper for executing a process for 
stopping said operation when said score value exceeds a 
reference value. 

27. (previously presented) The unauthorized- 
operation- judgment system of claim 17, further comprising: 

a warning-process for executing a process for 
displaying a warning on an operation screen of said 
computer, or generating a warning alarm on said computer, 
when said score exceeds a reference value . 
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28. (previously presented) The unauthorized- 
operation- judgment system of claim 17, further comprising: 

a warning-notification- transmitter for sending a 
notification warning to an administration server operated 
by an administrator of said computer that there is a 
possibility of an unauthorized operation, when said score 
exceeds a reference value. 

29. (currently amended) An unauthorized- 
operation- judgment method for determining whether an 
operation received by a computer is an unauthorized 
operation, comprising: 

receiving, by said computer, instruction data to 
cause said computer to execute said operation; 

creating, by said computer, a first profile from 
said instruction data related to the operation for which 
instruction data was received by said computer , wherein the 
first profile includes operations not identified with 
users ; 

storing, by said computer, said first profile in 
a first profile-storage unit; 

identifying, by said computer, a user that 
executed said operation by said instruction data; 
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creating, by said computer, a second profile 
related to the operation executed by said user, wherein the 
second profile includes only operations identified with 
users ; 

storing, by said computer, said second profile in 
a second profile-storage unit according to a user account ; 

comparing, by said computer, said instruction 
data with said first profile when said instruction data is 
received while said computer is not logged into a user 
account, and comparing said instruction data with at least 
said second profile corresponding to said user account when 
said instruction data is received while said computer is 
logged into said user account; and 

calculating, by said computer, a score for 
determining whether said operation is an unauthorized 
operation. 

30-32. (canceled) 

33. (previously presented) The unauthorized- 
operation- judgment method of claim 2 9 further comprising 
executing a process for detecting whether a certain user is 
logged into said computer, wherein when a certain user is 
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detected as being logged in to said computer, said creating 
of a second profile comprises creating said second profile 
related to said certain user. 

34 . (previously presented) The unauthorized- 
operation- judgment method of claim 33, wherein when a 
certain user is not detected as being logged in even though 
detection processing is executed, said creating of a first 
profile comprises creating said first profile related to 
said computer. 

35. (previously presented) The unauthorized- 
operation- judgment method of claim 34, wherein said 
detection processing is executed at specified intervals 
while said computer is in operation. 

36-3 8. (canceled) 

39. (new) A computer readable storage medium 
having unauthorized-operation- judgment program code stored 
thereon, wherein the unauthorized- operation- judgment 
program code, when executed by a computer, determines 
whether an operation to be performed by a computer is an 
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unauthorized operation, and wherein the unauthorized- 
operation- judgment program code, when executed, performs to 
the following functions: 

receiving instruction data that commands 
execution of said operation, wherein said operation 
includes power on of a computer; 

creating a first profile from said instruction 
data, wherein said first profile is at least partially- 
representative of said operation; 

storing said first profile in a first profile- 
storage unit; 

identifying a user who commands execution of said 
operation corresponding to said instruction data, wherein 
said user is associated with a user account; 

creating a second profile related to said 
operation commanded by said user; 

storing said second profile in a second profile- 
storage unit according to said user account; 

comparing said instruction data with at least 
said first profile when said instruction data is received 
while said computer is not logged into a user account; 

comparing said instruction data with at least 
said second profile corresponding to said user account when 
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said instruction data is received while said computer is 
logged into said user account; and, 

calculating a score based on said comparisons, 
wherein the score is useful in determining whether said 
operation is an unauthorized operation. 

40. (new) The computer readable storage medium 
of claim 3 9 wherein said unauthorized-operation- judgment 
program code, when executed, performs to the following 
further functions: 

detecting whether a certain user is logged into 
said computer; and, 

creating a second profile related to said certain 
user when the certain user is detected as being logged into 
said computer. 

41. (new) The computer readable storage medium 
of claim 40 wherein said unauthorized-operation- judgment 
program code, when executed, performs to the following 
further function: 
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creating the first profile related to said 
computer when the certain user is not detected as being 
logged in even though detection function is executed. 



42. (new) The computer readable storage medium 
of claim 41 wherein said unauthorized-operation- judgment 
program code, when executed, performs to the following 
further function: 

executing said detection function at specified 
intervals while said computer is in operation. 
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